Purple AI and Singularity Hyperautomation now autonomously investigate alerts, reach verdicts, and execute responses inside boundaries set by human security teams

SentinelOne® (NYSE:S), the AI Security leader, today announced governed, closed-loop response across the Singularity™ Platform, delivering trustworthy automation for security operations. Purple AI® and Singularity Hyperautomation now autonomously investigate alerts, reach verdicts, and execute responses. Security teams set the boundaries first, deciding where AI acts on its own and where it stops for human sign-off. The Autonomous SOC now runs from alert to action, at the speed and scale of AI, with the confidence and control of human defenders.

SOC teams have tried to embrace automation for years to deal with an overwhelming volume of alerts and data. Response automation was first attempted through SOAR playbooks, though those playbooks are fixed decision trees that break the moment reality diverges from the script. What stayed missing was judgment at the point of action. Purple AI supplies it, choosing the next step from what the investigation actually found rather than from a branch encoded months earlier. The loop closes.

The foundation is already carrying a production load. Purple AI Agentic Investigation has been running in customer environments since June, and now handles more than 8,500 critical autonomous investigations every day. More than a third of the eligible customer base has it running. Across that base, Purple AI investigates nearly three times as many alerts as analysts reach by hand. Alerts that would have aged in a queue get investigated, and analysts spend their hours on the decisions that need judgment.

"Security teams need AI they can trust to act within boundaries they set," said Chris Corde, Chief Product Officer, SentinelOne. "With this release, teams decide exactly where Purple AI is permitted to execute autonomously, and where it pauses for a human. That governance is what makes autonomous response viable in a live SOC. Human response time stretches on nights and weekends - attack timelines do not. In a single recent weekend, Purple AI investigated more than 5,000 critical alerts across our customer base, each in minutes. Nothing waited for Monday."

What decides whether a SOC can adopt autonomous response based on agentic reasoning is whether a human can see the action, trace it, and take it back. Every AI-driven action in the Singularity Platform is traceable, auditable, and overrideable by the team that authorized it.

Not every workflow needs to run unattended. The discipline is relevant control, staying in the decisions that carry real consequence and letting the rest run. Governance is the precondition, not the paperwork.

These capabilities are built into core components of the Singularity Platform. SOC teams get AI reasoning and automated execution inside the workflows, tools, and approval chains they already run. There is no integration work and no additional tooling required.

Building on Purple AI Agentic Investigation, the new capabilities use Singularity Hyperautomation workflows to:

Trigger a Purple AI Agentic Investigation from any point in a workflow, not only the initial alert.
Pull the full investigation report, with verdict and evidence, directly into automation logic.
Apply customizable LLM Actions to reason over the findings and call the right next step.
Call validated response snippets, reusable action blocks teams build once and use repeatedly.

The Hyperautomation workflow capabilities are expected to be generally available later this quarter. SentinelOne is demonstrating them at Black Hat USA 2026 in booth #2933, and a full demo is available on the SentinelOne YouTube channel.

Additional details and related information:

About SentinelOne

SentinelOne (NYSE:S) is the leader in AI security, setting the standard for using AI and automation to give defenders a decisive operating advantage. Built for those who secure our world, its platform delivers unified coverage across endpoints, identity, cloud, and AI. Powered by Autonomous Security Intelligence, SentinelOne stops attacks at machine speed, reducing risk and delivering clarity and control to stay one step ahead. Headquartered in Mountain View, California with teams worldwide, SentinelOne protects nearly one-fifth of the Fortune 500 and hundreds of Global 2000 enterprises. From Main Street to Wall Street, the world's most critical organizations trust SentinelOne with their security.

Category: Investors

View source version on businesswire.com: https://www.businesswire.com/news/home/20260803850895/en/

Media Contact:

Regan DePinto

press@sentinelone.com